Method for prioritizing grouped data reduction

ABSTRACT

Nodes of a network may be allocated to a number of logical groups thereof, and storage space within a network traffic monitoring device coupled to the network then allocated so as to ensure network traffic data for at least a minimum number of the nodes of each of the logical groups is stored.

FIELD OF THE INVENTION

The present invention relates to methods for ensuring network trafficdata for at least a minimum number of network nodes of a number oflogical groups of such nodes is stored at each of several time scales.

BACKGROUND

Packet-switched networks such as those that utilize the Internetprotocol are essential tools of many of today's businesses. Hence, it isessential that these networks be monitored to ensure the network trafficencounters minimal delays and other problems during transport. Suchmonitoring, however, involves the collection and storage of significantamounts of data. This presents several challenges, among them theproblem of how to ensure data is collected for at least a minimum numberof network nodes of a number of logical groups of such nodes at each ofseveral time scales.

SUMMARY OF THE INVENTION

Nodes of a network may be allocated to a number of logical groupsthereof, and storage space within a network traffic monitoring devicecoupled to the network then allocated so as to ensure network trafficdata for at least a minimum number of the nodes of each of the logicalgroups is stored. This allocation scheme may be replicated at each of anumber of time scales for the network traffic data. In one embodiment ofthe present invention, the storage space is allocated such that eachlogical group is permitted storage space for up to a minimum number ofnodes determined by a ratio of a total number of nodes of the networkand the number of logical groups of said nodes. Any excess storage spaceresulting from an absence of at least the minimum number of nodes in oneor more of the logical groups of nodes may then be reallocated to thoseof the logical groups of nodes having more than the minimum number ofnodes (e.g., on a round-robin, traffic volume, or number of nodes pergroup basis).

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a method for allocating storage for network traffic dataStatistics.

DETAILED DESCRIPTION

Described herein are methods for ensuring network traffic data for atleast a minimum number of network nodes of a number of logical groups ofsuch nodes is stored at each of several time scales at a network trafficmonitoring device.

In a typical configuration, the network traffic monitoring device iscoupled to an enterprise network (e.g., at an edge of such a network)and configured in such a way as to collect statistics regarding traffic(e.g., packets) flowing into, out of and within that network. In somecases, the network traffic monitoring device may be configured to groupdata so collected according to logical groups of network nodes withinthe enterprise network. For example, such groupings may be made at abusiness unit or other logical level. However, because the storagecapacity of the network monitoring device is not infinite, and becausesome enterprise networks can consist of thousands of nodes, the networktraffic monitoring device cannot collect and store data regarding allnodes of such logical groupings.

Because it is desirable to have at least some data collected for each ofthe various logical groupings of network nodes, for example to allowusers to monitor traffic conditions affecting all such groupings, somedecision regarding the allocation of the finite network trafficmonitoring device's storage capacity must be implemented. In accordancewith the present invention, the storage capacity is allocated so as toensure that network traffic data for at least a minimum number ofnetwork nodes of each logical group of such nodes is stored at each ofseveral time scales. Any excess storage capacity may then be allocatedto those logical groups of nodes that need or might benefit from same.

By way of example, at block 110, consider a network that includes “n”logical groupings of network nodes. Each group includes at least onenetwork node, but the groups need not include the same number of nodeseach. The rationale behind the logical groupings of nodes is notcritical to the present invention, but for purposes of this exampleassume that the logical groupings correspond to business units of theenterprise utilizing the network.

Each node of the network has an associated Internet protocol (IP)address. This is a unique node identifier that, among other things, actsas an address for other nodes to send traffic to, much in the same wayas a post office address is used to ensure that mail is properlydelivered. Collectively, the entire enterprise network has a total of“M” IP addresses associated therewith. M is the maximum number of IPaddresses for which data needs to be collected by the network trafficmonitoring device.

As indicated above, for a network of any substantial M, the networktraffic monitoring device cannot store data for all M IP addresses.Hence, at block 120, some minimal allocation of this limited storagespace is needed to ensure that for each of the n logical groupings ofthe IP addresses (i.e., the nodes associated therewith), some data isstored. In one embodiment of the present invention, this minimal numberis determined by the ratio of M to n (M/n=y). That is, for each logicalgroup, the network traffic monitoring device will initially allocatestorage space for at least y IP addresses of such group.

Some logical groups will, however, have fewer than y IP addressesassociated therewith. Hence, there will be excess storage spaceavailable at the network traffic monitoring device. At block 130, ratherthan allow this excess space to go unused, the network trafficmonitoring device will allocate it to those logical groups consisting ofmore than y IP addresses. Such allocation can be made in any of severalways, including but not limited to round-robin allocation, allocationbased on traffic volume, allocation based on number of IP addresses pergroup, etc.

Thus, the above allocation scheme ensures that for each logical groupingof nodes of the enterprise network, the network traffic monitoringdevice will store data for at least some IP addresses (nodes) of eachgroup. A further refinement of this allocation technique involvesmaintaining this same strategy across multiple time scales. That is, fornetwork traffic data grouped according to different time scales, thesame allocation scheme may be employed.

At block 140, consider that the network traffic monitoring device maycollect traffic statistics at any of a variety of time scales.Minute-by-minute collection is typical. However, a user may not want toview the data at such a low level of granularity. Instead, the use maywish to view the data at a higher level of granularity, such as anhour-by-hour or even day-by-day basis. At block 150, in accordance withan embodiment of the present invention, These higher-level statisticalcompilations may be pre-computed by the network traffic monitoringdevice so that when called for by the user there is no appreciable delayin presenting the results. In order to ensure that the limited storagespace of the network traffic monitoring device is not overwhelmed bysuch additional storage requirements, the same allocation scheme asdiscussed above may be applied to the data compilations for thesehigher-level results.

Thus, methods for ensuring network traffic data for at least a minimumnumber of network nodes of a number of logical groups of such nodes isstored at each of several time scales at a network traffic monitoringdevice have been described. In the foregoing description, variousexamples were set forth in order to aid in the understanding of thepresent invention. These examples, however, should not be read to limitthe scope of the present invention, which instead should only bemeasured in terms of the following claims.

1. A method, comprising: allocating nodes of a network to a number oflogical groups thereof, wherein said nodes include devices capable ofsending or receiving data over the network; and allocating storage spacewithin a network traffic monitoring device coupled to the network so asto ensure network traffic data for at least a minimum number of thenodes of each of the logical groups is stored, wherein said networktraffic data includes statistics regarding network traffic flow to andfrom said minimum number of nodes.
 2. The method of claim 1, wherein thestorage space is allocated at each of a number of time scales for thenetwork traffic data.
 3. The method of claim 2, wherein the storagespace is allocated such that each logical group is permitted storagespace for up to a minimum number of nodes determined by a ratio of atotal number of nodes of the network and the number of logical groups ofsaid nodes.
 4. The method of claim 3, wherein any excess storage spaceresulting from an absence of at least the minimum number of nodes in oneor more of the logical groups of nodes is reallocated to those of thelogical groups of nodes having more than the minimum number of nodes. 5.The method of claim 4, wherein the reallocation of the excess storagespace is made on a round-robin basis.
 6. The method of claim 4, whereinthe reallocation of the excess storage space is made on a traffic volumebasis.
 7. The method of claim 4, wherein the reallocation of the excessstorage space is made on a number of nodes per group basis.
 8. Themethod of claim 1, wherein the storage space is allocated such that eachlogical group is permitted storage space for up to a minimum number ofnodes determined by a ratio of a total number of nodes of the networkand the number of logical groups of said nodes.
 9. The method of claim8, wherein any excess storage space resulting from an absence of atleast the minimum number of nodes in one or more of the logical groupsof nodes is reallocated to those of the logical groups of nodes havingmore than the minimum number of nodes.
 10. The method of claim 9,wherein the reallocation of the excess storage space is made on around-robin basis.
 11. The method of claim 9, wherein the reallocationof the excess storage space is made on a traffic volume basis.
 12. Themethod of claim 9, wherein the reallocation of the excess storage spaceis made on a number of nodes per group basis.